策略创建API

创建策略（V2）

POST /api/v2/policies
Content-Type: application/json

创建策略绑定（V1）

POST /api/v1/policy-attachments
Content-Type: application/json

基础请求结构

{
  "name": "策略名称",
  "className": "策略类型",
  "config": "策略配置JSON字符串",
  "description": "策略描述（可选）"
}

{
  "attachResourceId": "资源ID1",
  "attachResourceType": "资源类型",
  "environmentId": "环境ID",
  "gatewayId": "网关ID",
  "policyId": "策略ID"
}

通用流量控制策略

• RateLimit - 流量限流

• ConcurrencyLimit - 并发限流

• CircuitBreaker - 熔断

• Timeout - 超时控制

• Retry - 重试策略

路由与转发策略

• HttpRewrite - HTTP重写

• HeaderModify - 请求头修改

• Redirect - 重定向

• DirectResponse - 直接响应

• Fallback - 降级策略

• DynamicRoute - 动态路由（泳道）

AI相关策略

• AiStatistics - AI统计

• AiSecurityGuard - AI安全护栏

• AiFallback - AI降级

• AiTokenRateLimit - AI Token限流

• AiCache - AI缓存

• AiNetworkSearch - AI网络搜索

• AiToolSelection - AI工具选择

安全认证策略

• Authentication - 统一认证

• JWTAuth - JWT认证

• OIDCAuth - OIDC认证

• ExternalZAuth - 外部认证

• Waf - Web应用防火墙

• IpAccessControl - IP访问控制

跨域与复制策略

• Cors - 跨域资源共享

• FlowCopy - 流量复制

服务治理策略

• ServiceTls - 服务TLS

• ServiceLb - 服务负载均衡

• ServicePortTls - 服务端口TLS

RateLimit - 流量限流

适用范围: Route, Gateway, Domain, Service

配置说明:

{
  "threshold": 100,
  "behaviorType": 0,
  "bodyEncoding": 0,
  "responseStatusCode": 429,
  "responseContentBody": "{\"error\":\"Too Many Requests\"}",
  "responseRedirectUrl": "",
  "enable": true
}

调用示例:

curl -X POST http://gateway-api/api/v2/policies \
  -H "Content-Type: application/json" \
  -d '{
    "name": "API限流策略",
    "className": "RateLimit",
    "config": "{\"threshold\":100,\"behaviorType\":0,\"bodyEncoding\":1,\"responseStatusCode\":429,\"responseContentBody\":\"{\\\"error\\\":\\\"请求过于频繁\\\"}\",\"enable\":true}",
    "description": "限制API每秒100次请求"
  }'

ConcurrencyLimit - 并发限流

适用范围: Route, Gateway, Domain

配置说明:

{
  "maxConcurrency": 50,
  "behaviorType": 0,
  "bodyEncoding": 0,
  "responseStatusCode": 503,
  "responseContentBody": "{\"error\":\"Service Overloaded\"}",
  "responseRedirectUrl": "",
  "enable": true
}

CircuitBreaker - 熔断

适用范围: Route, Service

配置说明:

{
  "strategy": 0,
  "minRequestAmount": 10,
  "maxAllowedMs": 5000,
  "triggerRatio": 50,
  "statDurationSec": 30,
  "recoveryTimeoutSec": 30,
  "responseStatusCode": 503,
  "bodyEncoding": 0,
  "responseContentBody": "{\"error\":\"Service Unavailable\"}",
  "responseRedirectUrl": "",
  "behaviorType": 0,
  "enable": true
}

Timeout - 超时控制

适用范围: Route, Service

配置说明:

{
  "unitNum": 30,
  "timeUnit": "s",
  "enable": true
}

Retry - 重试策略

适用范围: Route, Service

配置说明:

{
  "attempts": 3,
  "retryOn": ["5xx", "reset", "connect-failure"],
  "httpCodes": ["502", "503", "504"],
  "perTryTimeout": 10,
  "enable": true
}

HttpRewrite - HTTP重写

适用范围: Route

配置说明:

{
  "pathType": "Exact",
  "path": "/v2/api",
  "pattern": "",
  "substitution": "",
  "host": "new-backend.example.com",
  "enable": true
}

HeaderModify - 请求头修改

适用范围: Route, Gateway, Domain

配置说明:

{
  "enable": true,
  "headerOpItems": [
    {
      "directionType": "Request",
      "opType": "Add",
      "key": "X-Custom-Header",
      "value": "custom-value",
      "policyValueGenerateMode": "Custom"
    },
    {
      "directionType": "Request",
      "opType": "Update",
      "key": "Authorization",
      "value": "Bearer {{token}}",
      "policyValueGenerateMode": "Custom"
    },
    {
      "directionType": "Request",
      "opType": "Remove",
      "key": "X-Debug-Mode",
      "value": "",
      "policyValueGenerateMode": "Custom"
    }
  ]
}

Redirect - 重定向

适用范围: Route

配置说明:

{
  "code": "301",
  "host": "new-domain.com",
  "path": "/new-path",
  "enable": true
}

DirectResponse - 直接响应

适用范围: Route

配置说明:

{
  "code": "200",
  "body": "{\"status\":\"ok\",\"message\":\"Service Maintenance\"}",
  "enable": true
}

Fallback - 降级策略

适用范围: Route, Service

配置说明:

{
  "enable": true,
  "fallBackDestination": [
    {
      "serviceId": "backup-service-1",
      "serviceName": "backup-service-name",
      "serviceVersion": "v1",
      "port": "8080"
    }
  ]
}

IpAccessControl - IP访问控制

适用范围: Route, Gateway, Domain

配置说明:

{
  "name": "IP白名单策略",
  "description": "允许特定IP访问",
  "ipAccessControlResourceName": "api-route-1",
  "ipAccessControlResourceType": "Route",
  "ipAccessControlType": "White",
  "ipAccessControlContent": "192.168.1.0/24,10.0.0.1",
  "protocolLayer": "L7",
  "enable": true
}

Cors - 跨域资源共享

适用范围: Route, Gateway, Domain

配置说明:

{
  "allowOrigins": "https://example.com,https://app.example.com",
  "allowMethods": ["GET", "POST", "PUT", "DELETE"],
  "allowHeaders": "Content-Type,Authorization",
  "exposeHeaders": "X-Custom-Header",
  "timeUnit": "s",
  "unitNum": 3600,
  "allowCredentials": true,
  "enable": true
}

FlowCopy - 流量复制

适用范围: Route

配置说明:

{
  "targetServiceId": "test-service-id",
  "targetServiceName": "test-service",
  "port": "8080",
  "percentage": 10,
  "enable": true
}

DynamicRoute - 动态路由（泳道）

适用范围: Gateway

配置说明:

{
  "enable": true,
  "dynamicRouteSwimmingLaneConfigs": [
    {
      "swimmingLaneGroupId": 1001,
      "swimmingLaneId": 2001,
      "canaryModel": 0,
      "percentage": 20,
      "swimmingLaneTag": "lane-v2",
      "predicates": [
        {
          "type": "Header",
          "name": "x-env",
          "condition": "==",
          "value": "test"
        }
      ],
      "matchCondition": "And",
      "enable": true
    }
  ]
}

AiStatistics - AI统计

适用范围: Route, LLMApi, AgentApi

配置说明:

{
  "enable": true,
  "aiStatisticsConfig": {
    "logRequestContent": true,
    "logResponseContent": true
  }
}

AiSecurityGuard - AI安全护栏

适用范围: Service

配置说明:

{
  "enable": true,
  "serviceAddress": "http://security-guard-service:8080",
  "checkRequest": true,
  "checkResponse": true,
  "riskAlertLevel": "medium",
  "requestCheckService": "Security",
  "responseCheckService": "Security",
  "bufferLimit": 1000,
  "riskConfig": [
    {
      "type": "Global",
      "level": "high"
    },
    {
      "type": "ContentModeration",
      "level": "medium"
    }
  ]
}

AiTokenRateLimit - AI Token限流

适用范围: Route, LLMApi, AgentApi

配置说明:

{
  "enable": true,
  "rules": [
    {
      "limitType": "LimitByConsumer",
      "threshold": 10000,
      "timeWindow": 60,
      "responseStatusCode": 429,
      "responseContentBody": "{\"error\":\"Token limit exceeded\"}"
    }
  ],
  "enableGlobalRules": true,
  "globalRules": [
    {
      "limitType": "LimitByGlobal",
      "threshold": 100000,
      "timeWindow": 60
    }
  ],
  "redisConfig": {
    "serviceHost": "redis-service:6379",
    "servicePort": 6379,
    "database": 0,
    "username": "",
    "password": ""
  }
}

AiCache - AI缓存

适用范围: Route, LLMApi, AgentApi

配置说明:

{
  "enable": true,
  "cacheTTL": 3600,
  "cacheMode": "exact",
  "cacheKeyStrategy": "messages",
  "redisConfig": {
    "serviceHost": "redis-service:6379",
    "servicePort": 6379,
    "database": 0
  }
}

AiFallback - AI降级

适用范围: Service

配置说明:

{
  "enable": true,
  "fallbackModelMappings": [
    {
      "model": "gpt-4",
      "fallbackModels": [
        {
          "serviceId": "backup-service-1",
          "model": "gpt-3.5-turbo"
        }
      ]
    }
  ]
}

AiNetworkSearch - AI网络搜索

适用范围: Route, LLMApi, AgentApi

配置说明:

{
  "enable": true,
  "provider": "bing",
  "apiKey": "your-search-api-key",
  "maxResults": 10,
  "timeout": 5000
}

AiToolSelection - AI工具选择

适用范围: Route, LLMApi, AgentApi

配置说明:

{
  "enable": true,
  "tools": [
    {
      "name": "calculator",
      "description": "用于数学计算",
      "enabled": true
    }
  ]
}

Authentication - 统一认证

适用范围: Route, Gateway, Domain

配置说明:

{
  "authenticationType": "key-auth",
  "enable": true
}

JWTAuth - JWT认证

适用范围: Route, Gateway, Domain

配置说明:

{
  "name": "jwt-policy",
  "issuer": "https://auth.example.com",
  "sub": "",
  "jwks": "https://auth.example.com/.well-known/jwks.json",
  "tokenPosition": "header",
  "tokenName": "Authorization",
  "tokenNamePrefix": "Bearer ",
  "tokenPass": true,
  "whiteOrBlack": "",
  "authResources": [],
  "resources": "",
  "enable": true
}

OIDCAuth - OIDC认证

适用范围: Route, Gateway, Domain

配置说明:

{
  "issuer": "https://accounts.google.com",
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret",
  "redirectUri": "https://your-app.com/callback",
  "scopes": ["openid", "profile", "email"],
  "enable": true
}

ExternalZAuth - 外部认证

适用范围: Route, Gateway, Domain

配置说明:

{
  "authServiceUrl": "https://auth-service.example.com/verify",
  "timeout": 5000,
  "enable": true
}

Waf - Web应用防火墙

适用范围: Route, Gateway, Domain

配置说明:

{
  "enable": true
}

ServiceLb - 服务负载均衡

适用范围: Service

配置说明:

{
  "loadBalancerType": "ROUND_ROBIN",
  "consistentHashLBConfig": {
    "parameterName": "user-id",
    "httpCookie": {
      "name": "session-id",
      "path": "/",
      "ttl": "3600s"
    },
    "minimumRingSize": 1024,
    "consistentHashLBType": "HEADER"
  },
  "warmupDuration": 60,
  "enable": true
}

ServiceTls - 服务TLS

适用范围: Service

配置说明:

{
  "mode": "SIMPLE",
  "certId": "cert-id-123",
  "caCertId": "ca-cert-id-456",
  "caCertContent": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "subjectAltNames": ["*.example.com"],
  "sni": "backend-service.example.com",
  "enable": true
}

ServicePortTls - 服务端口TLS

适用范围: ServicePort

配置说明: 与ServiceTls相同

错误示例1：config字段格式错误

{
  "name": "限流策略",
  "className": "RateLimit",
  "config": {"threshold": 100}  //  错误：config应该是JSON字符串
}

正确写法：

{
  "name": "限流策略",
  "className": "RateLimit",
  "config": "{\"threshold\":100,\"behaviorType\":0,\"bodyEncoding\":0,\"responseStatusCode\":429,\"enable\":true}"
}

错误示例2：遗漏enable字段

{
  "name": "限流策略",
  "className": "RateLimit",
  "config": "{\"threshold\":100,\"behaviorType\":0,\"bodyEncoding\":0,\"responseStatusCode\":429}"  // 缺少enable字段
}

正确写法：

{
  "name": "限流策略",
  "className": "RateLimit",
  "config": "{\"threshold\":100,\"behaviorType\":0,\"bodyEncoding\":0,\"responseStatusCode\":429,\"enable\":true}"
}

成功响应

{
  "policyId": "policy-abc123"
}

错误响应

{
  "errorCode": "ErrInvalidParameter",
  "errorMessage": "Invalid parameter: className",
  "requestId": "req-xxx"
}